Biosecurity in the Age of AI – From Identifying What is Dangerous to Understanding What is Becoming Possible

In my previous article,[1] I argued that biodefense in an age of omni-use biotechnology must do more than seek to prevent crises altogether. It must also enable societies to detect warning signs early, limit the damage, maintain essential functions during a crisis, and recover afterward. Achieving this requires a whole-of-society approach that extends beyond healthcare, public health, and defense to research institutions, industry, local authorities, and civil society.

What, then, should we be looking for as we build this collective capacity to prepare? The growing convergence of artificial intelligence (AI) and the life sciences makes this question particularly urgent.

In 2026, in particular, European and U.S. research institutions, AI companies, and security experts have published a series of assessments of the security implications of AI-enabled biology. These include research demonstrating the creation of functional viruses built from AI-designed genomes,[2] proposals for new safeguards in AI-based protein design,[3] strategies for layered defenses against the misuse of AI in biological weapons development,[4] and reports by AI companies identifying potentially concerning uses of their systems in real-world life-science research.[5]

These developments cannot be understood simply as a new threat in which AI makes biological weapons easier to produce. They point to a more fundamental shift in how we define the object of biosecurity policy.

Traditionally, a central pillar of biosecurity has been to identify dangerous pathogens and toxins and control their possession, access, and transfer. Yet as AI converges with the life sciences, monitoring known agents and materials alone is increasingly insufficient. New research and development capabilities can emerge rapidly when AI, biological data, specialized expertise, DNA synthesis, and laboratory infrastructure are combined.[6]

Biosecurity must therefore look beyond the question of which pathogens are dangerous. It must continuously assess what biological capabilities are emerging, where they are developing, and how quickly. Here, biological capability means what researchers or organizations can actually accomplish by combining scientific knowledge, technologies, data, and equipment. The scope of biosecurity must expand from controlling dangerous pathogens to continuously monitoring, assessing, and managing rapidly evolving biological capabilities.

Why Monitoring Pathogens Alone is No Longer Enough

The arrival of AI has not suddenly brought a host of new dangerous pathogens into existence. What has changed most significantly is our capacity to conduct biological research.

A threat intelligence report published by Anthropic in September 2026 offers concrete examples.[7] Reviewing actual uses of its AI assistant Claude, the company identified applications in dual-use biological research involving highly pathogenic avian influenza, orthopoxviruses, and toxins. AI was used at multiple stages of research, including planning, reviewing literature and analyzing data, prioritizing experiments, and preparing grant applications and manuscripts.

These cases do not show that AI has created a biological weapon. Easier access to biological knowledge does not automatically translate into the capability to develop one. Tacit knowledge, experimental skills, equipment, and the ability to integrate different stages of research remain significant barriers. Nevertheless, Anthropic's findings matter because they illustrate how researchers who already possess relevant expertise may use AI to work faster and more efficiently. The policy question is therefore not simply whether AI is safe or dangerous, but which stages of research it changes, for whom, and to what extent.

This is a critical distinction. Controlling known dangerous pathogens and toxins does not necessarily reveal who is acquiring new research capabilities. Nor do those capabilities necessarily arise from a single inherently dangerous technology. They emerge through combinations of AI, biological data, scientific expertise, DNA synthesis, and laboratory facilities—components that each have legitimate and valuable applications.

Anthropic's evolving approach to safeguards is revealing in this respect. AI safety measures have traditionally focused on guardrails that identify dangerous requests or responses and prevent models from providing them. In the life sciences, however, the same knowledge and methods may support vaccine and therapeutic development or research involving dangerous pathogens. It is often difficult to draw a clear line between safe and unsafe requests based on their content alone.

Anthropic has therefore also explored a trusted-user approach that would allow vetted researchers to access advanced AI capabilities for legitimate biological research, rather than relying solely on blocking potentially dangerous questions.[8] Although this may appear to be the internal safety policy of an AI company, it signals an important shift in the focus of biosecurity from identifying dangerous information to managing access to research capabilities for specific purposes under specific conditions.

The question for biosecurity in the AI era is thus not merely whether an actor possesses a dangerous pathogen. It is also what capabilities different actors are acquiring by combining technologies and expertise. As AI and biotechnology advance, those capabilities will continue to evolve. Systems for managing known hazardous materials must be complemented by mechanisms for continuously observing and assessing where new capabilities emerge and how they are used.

From What to Prohibit to Where Capabilities Can Be Detected

How, then, can rapidly changing biological capabilities be managed? Unlike a pathogen or a piece of laboratory equipment, a capability is not directly visible. International policy discussions are therefore beginning to move beyond identifying and prohibiting dangerous items toward identifying points in the research process where emerging risks can be detected.[9]

An AI system may propose the design of a novel protein or gene, but a digital design does not by itself produce a biological organism. The design must be translated into physical material, tested experimentally, and evaluated to determine whether it has the intended properties. There are several steps between an AI-generated idea and a usable biological capability. These steps offer potential chokepoints at which safeguards can be applied.[10]

One example is DNA synthesis screening. Researchers can now submit sequence information to specialized companies rather than synthesizing all the DNA they need themselves. By screening orders for sequences associated with known dangerous pathogens or toxins, while also checking customers' identities, synthesis providers may be able to identify potentially harmful uses. The aim is not to monitor every activity involving AI, but to apply safeguards where digital designs begin to enter the physical world.

AI, however, presents new challenges even at these chokepoints. Rather than simply copying DNA or proteins found in nature, AI systems are increasingly capable of designing novel sequences and structures. Screening only for similarities to known dangerous sequences may therefore fail to identify some risks.

The Nuclear Threat Initiative (NTI), a U.S. nonprofit organization working to reduce threats from nuclear and biological weapons and other major security risks, has examined safeguards further upstream, at the stage of AI-enabled protein design.[11] One approach is to assess what users are asking a model to design and prevent the model from fulfilling requests that present clearly unacceptable risks. The underlying principle is to identify risks at multiple stages of research and development, rather than relying on a single chokepoint.

This broader approach is known as “defense in depth.” In August 2026, RAND argued that mitigating the risk of AI-assisted biological weapons development requires multiple complementary safeguards rather than any single protective measure.[12] These can be applied at different points in the research process, including access to AI systems and sensitive biological data, DNA synthesis orders, and the use of laboratory equipment and services. The goal is to layer safeguards and detection opportunities, not to assume that any one control can be made foolproof.

RAND also emphasizes the importance of combining weak signals from different chokepoints rather than assessing each in isolation. Anthropic's report suggests that this approach is already becoming relevant in the operation of real-world AI services.

AI companies may observe the kinds of research assistance users seek. DNA synthesis providers can see which sequences are ordered. Research institutions understand the objectives and experimental settings of their work, while governments hold other information relevant to national security and public health. Each can serve as a sensor, offering a different view of changes in biological capabilities.

The crucial question is who will connect these signals, analyze them, and translate the findings into policy decisions. This is an intelligence function in the broad sense—not simply the collection of classified information, but the integration of information from different sources, assessment of what emerging changes mean, and provision of actionable insights for policymakers.

Japan already has systems for controlling pathogens under the Infectious Diseases Control Law, regulating exports under the Foreign Exchange and Foreign Trade Act, promoting research security at universities and research institutions, and managing infectious disease crises. Yet these frameworks were established for different purposes and fall under different authorities. It remains unclear whether Japan has a sufficiently integrated function for continuously monitoring and assessing emerging biological capabilities across AI, the life sciences, industry, public health, and national security. Before simply adding new regulations, Japan should strengthen its ability to see and understand these changes.

The future of biosecurity does not lie in trying to prevent every possible danger through a single regulation. It lies in continuously identifying where and how new capabilities are taking shape—from AI-enabled research to laboratory practice—and connecting signals across different settings while assessing risks early. The ability to keep asking what is becoming possible, and to turn that understanding into informed policy decisions, will make biosecurity intelligence an essential foundation for governance in the age of omni-use biotechnology.

(2026/11/11)